CVE-2023-6395

CVSS 3.1 Score 6.7 of 10 (medium)

Details

Published Jan 16, 2024
Updated: Feb 9, 2024
CWE ID 20

Summary

CVE-2023-6395 is a vulnerability found in the Mock software, affecting products such as lgHYzE, s5UiSY, s5UiRj, m7Yqoh, and inDeFG. The vulnerability allows for privilege escalation, potentially enabling the execution of arbitrary code with root user privileges. This weakness arises from the lack of proper sandboxing during the expansion and execution of Jinja2 templates included in certain configuration parameters. The risk score is 68, and it has a base severity of MEDIUM. To remediate this vulnerability, it is recommended to ensure proper sandboxing and validation of input parameters to prevent unauthorized access and execution of code. This vulnerability poses a significant danger to organizations as it could lead to remote privilege escalation and unauthorized access to sensitive information or systems on the build server.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-6395 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options